CVE-2025-42876 — Missing Authorization Check in SAP S/4 HANA Private Cloud (Financials General Ledger)

CVE-2025-42876

Missing Authorization Check in SAP S/4 HANA Private Cloud (Financials General Ledger) PUBLISHED

Description (CNA)

Due to a Missing Authorization Check vulnerability in SAP S/4 HANA Private Cloud (Financials General Ledger), an authenticated attacker with authorization limited to a single company code could read sensitive data and post or modify documents across all company codes. Successful exploitation could result in a high impact to confidentiality and a low impact to integrity, while availability remains unaffected.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP S/4 HANA Private Cloud (Financials General Ledger)	affected S4CORE 104; affected 105; affected 106; affected 107; affected 108; affected 109

CWE

CWE-405

References

https://me.sap.com/notes/3672151
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.